This article provides steps to resolve issues where Application Identification downloads fail with the error: "Server certificate verification failed or Server not reachable."

Application Identification download fails, and the following error message is displayed:

{primary:node0}
root@srx> request services application-identification download status
Downloading application package (latest) failed with error (Server certificate verification failed or Server not reachable)

Follow the steps below to resolve the issue:

1) Check if signatures.juniper.net is resolving correctly using the command: show host signatures.juniper.net

2) If DNS is not resolving, verify reachability to the DNS server. Ensure the DNS server is configured correctly on the SRX device.

3) if DNS resolution is successful, test connectivity to port 443 using: telnet signatures.juniper.net 443

4) If Telnet fails, check whether any loopback filter is blocking IDP traffic. Verify that your network is not blocking this traffic.

5) If Telnet works but the download still fails, confirm that the DNS server is not returning an incorrect IP address due to static bindings.